TOTOlink A3002R Buffer Overflow Vulnerability in formIpv6Setup Interface

A buffer overflow vulnerability has been identified in the TOTOlink A3002R router, specifically in version 1.1.1-B20200824.0128. The issue arises from inadequate input validation of the pppoe_dns1 parameter within the formIpv6Setup interface of the Boa web server.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, access the formIpv6Setup interface of the TOTOlink A3002R router running the vulnerable firmware version. Submit a request that includes a crafted pppoe_dns1 parameter designed to exploit the buffer overflow. This can be done using a web browser or a tool like curl or Postman.